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We claim: 

*^ 

1 . A method for supporting multiple Virtual Private Networks in an MPOA/NHRP 
communication system, the method comprising: 

establishing a connection in the communication system; and 
using in-band signaling to designate the connection for a number of Virtual Private 
Networks. 

2. The method of claim 1 , wherein the act of using in-bahd signaling to designate the 
connection for a number of Virtual Private Networks comprises: 

using in-band signaling to add a Virtual Private Network to the connection. 

3. The method of claim 1 , wherein the act of using in-band signaling to designate the 
connection for a number of Virtual Private Networks comprises: 

using in-band signaling to remove a Virtual Private Network from the connection. 

4. The method of claim 1 , further comprising: 

multiplexing packets from the multiple Virtual Private Networks over the connection. 

5. The method of claim 4, wherein the act of multiplexing packets from the multiple 
Virtual Private Networks over the connection comprises: 

encoding a Virtual Private Network identifier in each packet. 

6. The method of claim 5, wherein the act of encoding a Virtual Private Network 
identifier in each packet comprises: 

associating a unique tag with each of the multiple Virtual Private Networks; 
determining the Virtual Private Network for a packet; and 
including the corresponding tag in the packet. 

7. The method of claim 5, wherein the act of encoding a Virtual Private Network 
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identifier in each packet comprises: 

including the Virtual Private Network identifier in the packet 

8. The method of claim 7, wherein the act of including the Virtual Private Network 
identifier in the packet comprises: 

including the Virtual Private Network identifier in a header within the packet. 



9. The method of claim 8, wherein the header comprises -an LLC/SNAP header. 
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10. An apparatus for supporting multiple Virtual Private Networks in an MPOA/NHRP 
communication system, the apparatus comprising: 

connection establishment logic operably coupled to establish a connection over the 
MPOA/NHRP communication system; 
5 in-band signaling logic operably coupled to use in-band signals to designate the 

connection for a number of Virtual Private Networks; and 

multiplexing logic operably coupled to multiplex packets from the number of Virtual 
Private Networks over the connection. 

10 11. The apparatus of claim 10, wherein the in-band signaling logic is operably coupled to 
send an in-band signal including a Virtual Private Network identifier identifying a Virtual 
Private Network to be added to the connection. 

12. The apparatus of claim 10, wherein the in-band signaling logic is operably coupled to 
15 send an in-band signal including a Virtual Private Network identifier identifying a Virtual 

Private Network to be removed from the connection. 

13. The apparatus of claim 10, wherein the multiplexing logic is operably coupled to 
encode a Virtual Private Network identifier in each packet. 

20 

14. The apparatus of claim 13, further comprising a database mapping each Virtual 
Private Network to a unique tag corresponding to the Virtual Private Network. 

15. The apparatus of claim 14, wherein the multiplexing logic is operably coupled to 

25 receive a packet associated with a Virtual Private Network, retrieve the tag corresponding to 
the Virtual Private Network from the database, and insert the tag into the packet. 

16. The apparatus of claim 13, wherein the multiplexing logic is operably coupled to 
include the Virtual Private Network identifier in each packet. 
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17. The apparatus of claim 16, wherein the multiplexing logic is operably coupled to 
include the Virtual Private Network identifier in a header within each packet. 

1 8. The apparatus of claim 17, wherein the header comprises an LLC/SNAP header. 

5 

19. The apparatus of claim 10, wherein the in-band signaling logic is operably coupled to 
receive an in-band signal including a Virtual Private Network identifier identifying a Virtual 
Private Network to be added to the connection. 

10 20. The apparatus of claim 10, wherein the in-band signaling logic is operably coupled to 
receive an in-band signal including a Virtual Private Network identifier identifying a Virtual 
Private Network to be removed from the connection. 

21. The apparatus of claim 10, wherein the multiplexing logic is operably coupled to 
15 receive the packets over the connection and determine a Virtual Private Network for each 

packet. 

22. The apparatus of claim 21, wherein the multiplexing logic is operably coupled to 
determine the Virtual Private Network for each packet based upon inherent information 

20 within each packet. 

23. The apparatus of claim 21, wherein the multiplexing logic is operably coupled to 
determine the Virtual Private Network for each packet based upon a Virtual Private Network 
identifier encoded in each packet. 

25 

24. The apparatus of claim 23, further comprising a database mapping each of a plurality 
of tags to a corresponding Virtual Private Network identifier. 



25. The apparatus of claim 24, wherein each packet includes a tag, and wherein the 
30 multiplexing logic is operably coupled to retrieve the Virtual Private Network identifier from 
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the database based upon the tag. 

26. The apparatus of claim 23, wherein each packet includes a Virtual Private Network 
identifier, and wherein the multiplexing logic is operably coupled to extract the Virtual 
Private Network identifier from the packet. 

27- The apparatus of claim 26, wherein the Virtual Private Network identifier is included 
in a header within each packet. 

28. The apparatus of claim 27, wherein the header comprises an LLC/SNAP header. 
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29. A computer program product comprising a computer readable medium having 
embodied therein a computer program for supporting multiple Virtual Private Networks in an 
MPOA/NHRP communication system, the computer program comprising: 

connection establishment logic programmed to establish a connection over the 
5 MPOA/NHRP communication system; 

in-band signaling logic programmed to use in-band signals to designate the connection 
for a number of Virtual Private Networks; and 

multiplexing logic programmed to multiplex packets from the number of Virtual 
Private Networks over the connection, 

10 

30. The computer program product of claim 29, wherein the in-band signaling logic is 
programmed to send an in-band signal including a Virtual Private Network identifier 
identifying a Virtual Private Network to be added to the connection. 

15 31. The computer program product of claim 29, wherein the in-band signaling logic is 
programmed to send an in-band signal including a Virtual Private Network identifier 
identifying a Virtual Private Network to be removed from the connection. 

32. The computer program product of claim 29, wherein the multiplexing logic is 
20 programmed to encode a Virtual Private Network identifier in each packet. 

33. The computer program product of claim 32, wherein the multiplexing logic is 
operably coupled to a database mapping each Virtual Private Network to a unique tag 
corresponding to the Virtual Private Network. 

25 

34. The computer program product of claim 33, wherein the multiplexing logic is 
programmed to receive a packet associated with a Virtual Private Network, retrieve the tag 
corresponding to the Virtual Private Network from the database, and insert the tag into the 
packet. 

30 
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35. The computer program product of claim 32, wherein the multiplexing logic is 
programmed to include the Virtual Private Network identifier in each packet 

36. The computer program product of claim 35, wherein the multiplexing logic is 

5 programmed to include the Virtual Private Network identifier in a header within each packet. 

37. The computer program product of claim 36, wherein the header comprises an 
LLC/SNAP header. 

10 38. The computer program product of claim 29, wherein the in-band signaling logic is 
programmed to receive an in-band signal including a Virtual Private Network identifier 
identifying a Virtual Private Network to be added to the connection. 

39. The computer program product of claim 29, wherein the in-band signaling logic is 
15 programmed to receive an in-band signal including a Virtual Private Network identifier 

identifying a Virtual Private Network to be removed from the connection. 

40. The computer program product of claim 29, wherein the multiplexing logic is 
programmed to receive the packets over the connection and determine a Virtual Private 

20 Network for each packet. 

41 . The computer program product of claim 40, wherein the multiplexing logic is 
programmed to determine the Virtual Private Network for each packet based upon inherent 
information within each packet. 

25 

42. The computer program product of claim 40, wherein the multiplexing logic is 
programmed to determine the Virtual Private Network for each packet based upon a Virtual 
Private Network identifier encoded in each packet. 



30 
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The computer program product of claim 42, wherein the multiplexing logic is 
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operably coupled to a database mapping each of a plurality of tags to a corresponding Virtual 
Private Network identifier. 

44. The computer program product of claim 43, wherein each packet includes a tag, and 
wherein the multiplexing logic is programmed to retrieve the Virtual Private Network 
identifier from the database based upon the tag. 

45. The computer program product of claim 42, wherein each packet includes a Virtual 
Private Network identifier, and wherein the multiplexing logic is programmed to extract the 
Virtual Private Network identifier from the packet. 

46. The computer program product of claim 45, wherein the Virtual Private Network 
identifier is included in a header within each packet. 

47. The computer program product of claim 46, wherein the header comprises an 
LLC/SNAP header. 
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48. A communication system for supporting multiple Virtual Private Networks, the 
communication system comprising an ingress MPOA client in communication with an egress 
MPOA client over an MPOA/NHRP network, wherein the ingress MPOA client establishes a 
connection to the egress MPOA client over the MPOA/NHRP network, sends in-band 
messages to the egress MPOA client over the connection in order to designate the connection 
for a number of Virtual Private Networks, and multiplexes packets from the number of 
Virtual Private Networks over the connection. 
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49. A method for supporting multiple Virtual Private Networks using the Next Hop 
Resolution Protocol (NHRP), the method comprising: 

determining a Virtual Private Network for each NHRP message; and 
encoding a Virtual Private Network identifier in each NHRP message. 

50. The method of claim 49, wherein the act of encoding the Virtual Private Network 
identifier in each NHRP message comprises including the Virtual Private Network identifier 
in a header within each packet. 

51. The method of claim 50, wherein the header is a LLC/SNAP header. 

52. The method of claim 49, wherein the act of encoding the Virtual Private Network 
identifier in each NHRP message comprises: 

associating each Virtual Private Network with a unique tag; and 

including in each packet the unique tag corresponding to the Virtual Private Network. 



